Palo_Alto_Networks
XSOAR-ENGINEER · Question #2
What is the result of an indicator being marked as expired?
The correct answer is A. It still exists and can be searched.. When an indicator is marked as expired in XSOAR, it remains in the system and can still be searched, but it is considered inactive for enrichment, correlation, or automation unless specifically configured otherwise.
Threat Intelligence Management
Question
What is the result of an indicator being marked as expired?
Options
- AIt still exists and can be searched.
- BIt is immediately deleted from the database.
- CIt still exists but is not searchable.
- DIt is deleted from the database after seven days.
How the community answered
(36 responses)- A89% (32)
- B6% (2)
- C3% (1)
- D3% (1)
Explanation
When an indicator is marked as expired in XSOAR, it remains in the system and can still be searched, but it is considered inactive for enrichment, correlation, or automation unless specifically configured otherwise.
Topics
#indicator lifecycle#indicator expiration#threat intelligence#indicator search
Community Discussion
No community discussion yet for this question.